Privacy Policy

Lostways is operated by Madeleine Austin, contactable at hello@lostways.co.uk.

• Email address: used to create your account and to send you one-time login codes.
• Login codes: a single-use numeric code generated at each login attempt. We do not use or store passwords.
• Account and profile information: anything you choose to add to your profile, including your home postcode, which we use (via a postcode lookup service, see “Who we share your data with” below) to estimate drive times to places you’re interested in.
• Content you create: places, trips, lists, and notes you save in the app, including anything you choose to write in free-text notes or reviews.
• Places you suggest: if you use the “Missing somewhere?” form, we collect whatever you enter about the place, plus your display name at the time of submission (shown publicly as “Suggested by [name]” if the place is published and you didn’t choose to submit anonymously). This is treated differently from your other content - see “How long we keep your data” below.
• Contact form messages: if you use our Contact form, we collect the name, email address, and message you provide, solely to respond to you. This isn’t stored in our database; it’s sent directly to us as an email.
• Basic technical data: standard server logs (IP address, browser type, timestamps) generated automatically by our hosting provider.

We do not knowingly collect data to create accounts for children. Lostways is intended for use by adults who may be planning trips that include children; any information about a child that a parent or guardian chooses to enter into their own trip plan is treated as part of that adult’s account data, not as a child’s account.

When you log in, we generate a one-time numeric code and email it to you. This code:

• expires after a short period,
• can only be used once,
• is not itself a password and is not reused across logins.

We don’t ask you to create or remember a password. A code’s record is deleted shortly after it’s used or expires (typically within a few minutes); we don’t keep login codes around once they’re no longer valid.

We use third-party service providers to run Lostways:

• Resend: delivers login codes and Contact form messages on our behalf. Resend’s Data Processing Addendum applies to our account regardless of plan, and they retain email content and delivery logs for up to 30 days before deleting them.
• Vercel: hosting and infrastructure.
• Turso: our database host; this is where your account, profile, and trip data is stored.

We’re currently on free/starter plans with Vercel and Turso, which don’t include a formal Data Processing Agreement (DPA), a contractual guarantee limiting a provider to only processing data on our instructions. We choose these providers carefully and only share what each needs to run the Service, but specific contractual protection isn’t yet in place with these two, reflecting our current small scale as a private testing project.

We also use two services that work a little differently:

• postcodes.io: a free, public UK postcode lookup service. If you enter a home postcode, we send it to postcodes.io solely to convert it into map coordinates, so we can estimate drive times for you.
• OpenStreetMap: when you use Map view, your browser loads map tiles directly from OpenStreetMap’s own servers (not routed through us), which receives your IP address as a normal part of that request. See OpenStreetMap’s own privacy policy for how they handle this.

Some of these providers may process data outside the UK (for example, in the US). Where that happens, we rely on legally recognised transfer safeguards, such as the UK International Data Transfer Addendum or an equivalent adequacy mechanism.

We do not sell your data, and we do not share it with advertisers.

Lostways uses two strictly necessary cookies:

• one to keep you logged in between visits;
• one used only by site administrators, to temporarily preview the app as another user for support/testing purposes.

We also store your light/dark mode preference in your browser’s local storage; this never leaves your device.

None of these require your consent: they’re essential to the Service working (or, for the theme preference, a plain local display setting), not tracking.

• Login codes: deleted shortly after use or expiry (typically within a few minutes) on our side; we don’t keep them around once they’re no longer valid. Resend, which delivers them, separately retains a copy of the email content/logs for up to 30 days (see above).
• Contact form messages: not stored in our own database (see above).
• Account and trip data: kept for as long as your account exists. You can delete your account, and everything tied to it, at any time (see below); we don’t automatically delete or anonymise data based on inactivity.
• Places you suggest: kept indefinitely, and not deleted if you delete your account (this is the one exception to the paragraph below). By submitting a place, you’re agreeing that we can use, edit, and publish it, and that it - and, if you chose to be credited, your display name at the time you submitted it - stays on the Service even after your account is gone. If your suggestion is declined rather than published, we still keep a record of it having been submitted.
• Server logs: kept for around 1 hour on our current hosting plan, then no longer accessible to us.

If you delete your account, we remove your personal data immediately (list items, saved/ruled-out places, private notes, reviews, submitted corrections, and your account profile), except that we keep a non-identifying, one-way hashed record that an account existed and when it was deleted, to help prevent abuse of the deletion process (this hash cannot be reversed to reveal your email address), and except for any place you’ve suggested, which is kept as described above regardless of what happens to your account.

Under UK data protection law, you have the right to:

• ask what personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data;
• object to, or ask us to restrict, certain processing;
• ask for your data in a portable format.

From your Profile page, you can download a copy of all your data at any time, as well as permanently delete your account and everything tied to it. For anything else, or if you’d rather we handle a request directly, email hello@lostways.co.uk. We’ll acknowledge your request and aim to respond within one month.

If you’re unhappy with how we’ve handled your data, please tell us first at hello@lostways.co.uk. We’ll acknowledge your complaint within 5 working days and aim to give you a full response within 30 days.

If you’re not satisfied with our response, you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

We take reasonable technical and organisational steps to protect your data, including using single-use, time-limited login codes rather than passwords, rate-limiting login attempts to prevent guessing, and restricting access to our systems.

No online service can be 100% secure, and we can’t guarantee absolute security of information transmitted to the Service.

We may update this policy as Lostways develops, particularly as we move from private testing towards a wider release. We’ll update the “last updated” date above when we do, and let existing users know of any significant change.

Questions about this policy or your data: hello@lostways.co.uk.